x/vulndb: potential Go vuln in go.etcd.io/etcd: GHSA-pm3m-32r3-7mfh

[GoVulnBot]

In GitHub Security Advisory GHSA-pm3m-32r3-7mfh, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
go.etcd.io/etcd	3.3.23	< 3.3.23

Cross references:

• Module go.etcd.io/etcd appears in issue x/vulndb: potential Go vuln in go.etcd.io/etcd: GHSA-wf43-55jj-vwq8 #884 NOT_IMPORTABLE
• Module go.etcd.io/etcd appears in issue x/vulndb: potential Go vuln in go.etcd.io/etcd #5
• Module go.etcd.io/etcd appears in issue dummy issue #77

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: go.etcd.io/etcd
      versions:
        - fixed: 3.3.23
      packages:
        - package: go.etcd.io/etcd
    - module: go.etcd.io/etcd
      versions:
        - introduced: TODO (earliest fixed "3.4.10", vuln range ">= 3.4.0-rc.0, <= 3.4.9")
      packages:
        - package: go.etcd.io/etcd
summary: |-
    Etcd embed auto compaction retention negative value causing a compaction loop or
    a crash
ghsas:
    - GHSA-pm3m-32r3-7mfh
references:
    - advisory: https://github.com/etcd-io/etcd/security/advisories/GHSA-pm3m-32r3-7mfh
    - advisory: https://github.com/advisories/GHSA-pm3m-32r3-7mfh

[zpavlinovic]

Future reference: the fix/symbols are mentioned in the security audit on page 30.

[gopherbot]

Change https://go.dev/cl/563538 mentions this issue: data/excluded: add GO-2024-2529.yaml

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports